[FW1] Citrix/Terminal Server and Hyperion via FW-1

["Coleman, Clayton L" <lcoleman@FW1-NOSPAMfoxboro.com>]

Hyperion is an application used by our company.  In order to extend the
remote-capabilities of it we are going to be implementing a
Windows2000-based terminal server.   At the same point in time we will be
installing a webserver that has the capability of emulating Citrix in a web
browser (using Java, the product is NFuse). 

We have several scenarios for implementing this system and I'm trying to
determine which is a good balance of security and functionality.  The
biggest problem with implementing this will be that all of the above
applications require NT domain authentication.  

I have several options:

(1) Place the webserver on our DMZ.  The webserver will need access to our
domain controllers for authentication (135 & NBT ports).  Once users have
authenticated and their Java client is intialized, they will establish a
connection DIRECTLY to the terminal server.  This would protect the
webserver but the terminal server would be exposed to the Internet while it
sits on our corporate LAN.  Several consultants have recommended this
solution to us.

(2) Place the webserver and terminal server on our DMZ.  This would still
require opening ports to our domain controllers for authentication.
However, it does seem that this would be a better solution because we can
restrict what access the terminal server would have to our internal nets.  

In either scenerio, the terminal server would need access (on specific
ports) to our Hyperion application.  I only see merits in the second choice,
but for some reason my vendors don't.  Do we just allow inbound access to a
terminal/Citrix server?  It does seem to be common practice from what I have
been reading.  If there are any documents specifically dealing with
Firewall-1 and Citrix, please show me where I can find them!

Clayton


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================